Safely demonstrating a subdomain takeover

Based on personal experience, claiming the subdomain discreetly and serving a harmless file on a hidden page is usually enough to demonstrate the security vulnerability. Do not serve content on the index page. A good proof of concept could consist of an HTML comment served via a random path:

Please be advised that this depends on what bug bounty program you are targeting. When in doubt, please refer to the bug bounty program's security policy and/or request clarifications from the team behind the program.

How to use this project

I recommend searching for the name of the service you are targeting in the issues tab. That way you can see the on-going discussion and more detailed steps on how to claim the subdomain you are after.

How to contribute

You can submit new services here: https://github.com/EdOverflow/can-i-take-over-xyz/issues/new?template=new-entry.md.

A list of services that can be checked (although check for duplicates against this list first) can be found here: https://github.com/EdOverflow/can-i-take-over-xyz/issues/26.

All entries

Note: fingerprints.json is automatically updated based on the content of this table.

Column header definitions:

• Engine: Name of service
• Status: Whether the service is vulnerable
• Verified by CI/CD: Whether automated fingerprint check is currently passing
• Domains: Comma-separate domains (used for fingerprint auto-verification)
• Fingerprint: Regex indicating vulnerable page (or NXDOMAIN, indicating non-existent DNS record)
• Discussion: Link to issue on this repo for discussion
• Documentation: Link to official documentation